--- /dev/null
+From e03fa055bc126e536c7f65862e08a9b143138ea9 Mon Sep 17 00:00:00 2001
+From: Daniel T Chen <crimsun@ubuntu.com>
+Date: Tue, 28 Dec 2010 17:20:02 -0500
+Subject: ALSA: hda: Use LPIB quirk for Dell Inspiron m101z/1120
+
+From: Daniel T Chen <crimsun@ubuntu.com>
+
+commit e03fa055bc126e536c7f65862e08a9b143138ea9 upstream.
+
+Sjoerd Simons reports that, without using position_fix=1, recording
+experiences overruns. Work around that by applying the LPIB quirk
+for his hardware.
+
+Reported-and-tested-by: Sjoerd Simons <sjoerd@debian.org>
+Signed-off-by: Daniel T Chen <crimsun@ubuntu.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/hda_intel.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2302,6 +2302,7 @@ static struct snd_pci_quirk position_fix
+ SND_PCI_QUIRK(0x1028, 0x01cc, "Dell D820", POS_FIX_LPIB),
+ SND_PCI_QUIRK(0x1028, 0x01de, "Dell Precision 390", POS_FIX_LPIB),
+ SND_PCI_QUIRK(0x1028, 0x01f6, "Dell Latitude 131L", POS_FIX_LPIB),
++ SND_PCI_QUIRK(0x1028, 0x0470, "Dell Inspiron 1120", POS_FIX_LPIB),
+ SND_PCI_QUIRK(0x103c, 0x306d, "HP dv3", POS_FIX_LPIB),
+ SND_PCI_QUIRK(0x1043, 0x813d, "ASUS P5AD2", POS_FIX_LPIB),
+ SND_PCI_QUIRK(0x1043, 0x81b3, "ASUS", POS_FIX_LPIB),
--- /dev/null
+From e692cb668fdd5a712c6ed2a2d6f2a36ee83997b4 Mon Sep 17 00:00:00 2001
+From: Martin K. Petersen <martin.petersen@oracle.com>
+Date: Wed, 1 Dec 2010 19:41:49 +0100
+Subject: block: Deprecate QUEUE_FLAG_CLUSTER and use queue_limits instead
+
+From: Martin K. Petersen <martin.petersen@oracle.com>
+
+commit e692cb668fdd5a712c6ed2a2d6f2a36ee83997b4 upstream.
+
+When stacking devices, a request_queue is not always available. This
+forced us to have a no_cluster flag in the queue_limits that could be
+used as a carrier until the request_queue had been set up for a
+metadevice.
+
+There were several problems with that approach. First of all it was up
+to the stacking device to remember to set queue flag after stacking had
+completed. Also, the queue flag and the queue limits had to be kept in
+sync at all times. We got that wrong, which could lead to us issuing
+commands that went beyond the max scatterlist limit set by the driver.
+
+The proper fix is to avoid having two flags for tracking the same thing.
+We deprecate QUEUE_FLAG_CLUSTER and use the queue limit directly in the
+block layer merging functions. The queue_limit 'no_cluster' is turned
+into 'cluster' to avoid double negatives and to ease stacking.
+Clustering defaults to being enabled as before. The queue flag logic is
+removed from the stacking function, and explicitly setting the cluster
+flag is no longer necessary in DM and MD.
+
+Reported-by: Ed Lin <ed.lin@promise.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ block/blk-merge.c | 6 +++---
+ block/blk-settings.c | 25 ++-----------------------
+ block/blk-sysfs.c | 2 +-
+ drivers/md/dm-table.c | 5 -----
+ drivers/md/md.c | 3 ---
+ drivers/scsi/scsi_lib.c | 3 +--
+ include/linux/blkdev.h | 9 ++++++---
+ 7 files changed, 13 insertions(+), 40 deletions(-)
+
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -21,7 +21,7 @@ static unsigned int __blk_recalc_rq_segm
+ return 0;
+
+ fbio = bio;
+- cluster = test_bit(QUEUE_FLAG_CLUSTER, &q->queue_flags);
++ cluster = blk_queue_cluster(q);
+ seg_size = 0;
+ nr_phys_segs = 0;
+ for_each_bio(bio) {
+@@ -87,7 +87,7 @@ EXPORT_SYMBOL(blk_recount_segments);
+ static int blk_phys_contig_segment(struct request_queue *q, struct bio *bio,
+ struct bio *nxt)
+ {
+- if (!test_bit(QUEUE_FLAG_CLUSTER, &q->queue_flags))
++ if (!blk_queue_cluster(q))
+ return 0;
+
+ if (bio->bi_seg_back_size + nxt->bi_seg_front_size >
+@@ -123,7 +123,7 @@ int blk_rq_map_sg(struct request_queue *
+ int nsegs, cluster;
+
+ nsegs = 0;
+- cluster = test_bit(QUEUE_FLAG_CLUSTER, &q->queue_flags);
++ cluster = blk_queue_cluster(q);
+
+ /*
+ * for each bio in rq
+--- a/block/blk-settings.c
++++ b/block/blk-settings.c
+@@ -125,7 +125,7 @@ void blk_set_default_limits(struct queue
+ lim->alignment_offset = 0;
+ lim->io_opt = 0;
+ lim->misaligned = 0;
+- lim->no_cluster = 0;
++ lim->cluster = 1;
+ }
+ EXPORT_SYMBOL(blk_set_default_limits);
+
+@@ -468,15 +468,6 @@ EXPORT_SYMBOL(blk_queue_io_opt);
+ void blk_queue_stack_limits(struct request_queue *t, struct request_queue *b)
+ {
+ blk_stack_limits(&t->limits, &b->limits, 0);
+-
+- if (!t->queue_lock)
+- WARN_ON_ONCE(1);
+- else if (!test_bit(QUEUE_FLAG_CLUSTER, &b->queue_flags)) {
+- unsigned long flags;
+- spin_lock_irqsave(t->queue_lock, flags);
+- queue_flag_clear(QUEUE_FLAG_CLUSTER, t);
+- spin_unlock_irqrestore(t->queue_lock, flags);
+- }
+ }
+ EXPORT_SYMBOL(blk_queue_stack_limits);
+
+@@ -547,7 +538,7 @@ int blk_stack_limits(struct queue_limits
+ t->io_min = max(t->io_min, b->io_min);
+ t->io_opt = lcm(t->io_opt, b->io_opt);
+
+- t->no_cluster |= b->no_cluster;
++ t->cluster &= b->cluster;
+ t->discard_zeroes_data &= b->discard_zeroes_data;
+
+ /* Physical block size a multiple of the logical block size? */
+@@ -643,7 +634,6 @@ void disk_stack_limits(struct gendisk *d
+ sector_t offset)
+ {
+ struct request_queue *t = disk->queue;
+- struct request_queue *b = bdev_get_queue(bdev);
+
+ if (bdev_stack_limits(&t->limits, bdev, offset >> 9) < 0) {
+ char top[BDEVNAME_SIZE], bottom[BDEVNAME_SIZE];
+@@ -654,17 +644,6 @@ void disk_stack_limits(struct gendisk *d
+ printk(KERN_NOTICE "%s: Warning: Device %s is misaligned\n",
+ top, bottom);
+ }
+-
+- if (!t->queue_lock)
+- WARN_ON_ONCE(1);
+- else if (!test_bit(QUEUE_FLAG_CLUSTER, &b->queue_flags)) {
+- unsigned long flags;
+-
+- spin_lock_irqsave(t->queue_lock, flags);
+- if (!test_bit(QUEUE_FLAG_CLUSTER, &b->queue_flags))
+- queue_flag_clear(QUEUE_FLAG_CLUSTER, t);
+- spin_unlock_irqrestore(t->queue_lock, flags);
+- }
+ }
+ EXPORT_SYMBOL(disk_stack_limits);
+
+--- a/block/blk-sysfs.c
++++ b/block/blk-sysfs.c
+@@ -114,7 +114,7 @@ static ssize_t queue_max_segments_show(s
+
+ static ssize_t queue_max_segment_size_show(struct request_queue *q, char *page)
+ {
+- if (test_bit(QUEUE_FLAG_CLUSTER, &q->queue_flags))
++ if (blk_queue_cluster(q))
+ return queue_var_show(queue_max_segment_size(q), (page));
+
+ return queue_var_show(PAGE_CACHE_SIZE, (page));
+--- a/drivers/md/dm-table.c
++++ b/drivers/md/dm-table.c
+@@ -1136,11 +1136,6 @@ void dm_table_set_restrictions(struct dm
+ */
+ q->limits = *limits;
+
+- if (limits->no_cluster)
+- queue_flag_clear_unlocked(QUEUE_FLAG_CLUSTER, q);
+- else
+- queue_flag_set_unlocked(QUEUE_FLAG_CLUSTER, q);
+-
+ if (!dm_table_supports_discards(t))
+ queue_flag_clear_unlocked(QUEUE_FLAG_DISCARD, q);
+ else
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -4289,9 +4289,6 @@ static int md_alloc(dev_t dev, char *nam
+ goto abort;
+ mddev->queue->queuedata = mddev;
+
+- /* Can be unlocked because the queue is new: no concurrency */
+- queue_flag_set_unlocked(QUEUE_FLAG_CLUSTER, mddev->queue);
+-
+ blk_queue_make_request(mddev->queue, md_make_request);
+
+ disk = alloc_disk(1 << shift);
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -1632,9 +1632,8 @@ struct request_queue *__scsi_alloc_queue
+
+ blk_queue_max_segment_size(q, dma_get_max_seg_size(dev));
+
+- /* New queue, no concurrency on queue_flags */
+ if (!shost->use_clustering)
+- queue_flag_clear_unlocked(QUEUE_FLAG_CLUSTER, q);
++ q->limits.cluster = 0;
+
+ /*
+ * set a reasonable default alignment on word boundaries: the
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -246,7 +246,7 @@ struct queue_limits {
+
+ unsigned char misaligned;
+ unsigned char discard_misaligned;
+- unsigned char no_cluster;
++ unsigned char cluster;
+ signed char discard_zeroes_data;
+ };
+
+@@ -369,7 +369,6 @@ struct request_queue
+ #endif
+ };
+
+-#define QUEUE_FLAG_CLUSTER 0 /* cluster several segments into 1 */
+ #define QUEUE_FLAG_QUEUED 1 /* uses generic tag queueing */
+ #define QUEUE_FLAG_STOPPED 2 /* queue is stopped */
+ #define QUEUE_FLAG_SYNCFULL 3 /* read queue has been filled */
+@@ -392,7 +391,6 @@ struct request_queue
+ #define QUEUE_FLAG_SECDISCARD 19 /* supports SECDISCARD */
+
+ #define QUEUE_FLAG_DEFAULT ((1 << QUEUE_FLAG_IO_STAT) | \
+- (1 << QUEUE_FLAG_CLUSTER) | \
+ (1 << QUEUE_FLAG_STACKABLE) | \
+ (1 << QUEUE_FLAG_SAME_COMP) | \
+ (1 << QUEUE_FLAG_ADD_RANDOM))
+@@ -550,6 +548,11 @@ enum {
+
+ #define rq_data_dir(rq) ((rq)->cmd_flags & 1)
+
++static inline unsigned int blk_queue_cluster(struct request_queue *q)
++{
++ return q->limits.cluster;
++}
++
+ /*
+ * We regard a request as sync, if either a read or a sync write
+ */
--- /dev/null
+From 687a993339c4f3a63654746230da3aab8bbdbffd Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Fri, 3 Dec 2010 15:19:13 +0100
+Subject: libata-sff: fix HSM_ST_ERR handling in __ata_sff_port_intr()
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 687a993339c4f3a63654746230da3aab8bbdbffd upstream.
+
+While separating out BMDMA irq handler from SFF, commit c3b28894
+(libata-sff: separate out BMDMA irq handler) incorrectly made
+__ata_sff_port_intr() consider an IRQ to be an idle one if the host
+state was transitioned to HSM_ST_ERR by ata_bmdma_port_intr().
+
+This makes BMDMA drivers ignore IRQs reporting host bus error which
+leads to timeouts instead of triggering EH immediately. Fix it by
+making __ata_sff_port_intr() consider the IRQ to be an idle one iff
+the state is HSM_ST_IDLE. This is equivalent to adding HSM_ST_ERR to
+the "break"ing case but less error-prone.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: Antonio Toma <antonio.toma@gmail.com>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/libata-sff.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/ata/libata-sff.c
++++ b/drivers/ata/libata-sff.c
+@@ -1532,11 +1532,10 @@ static unsigned int __ata_sff_port_intr(
+ if (!(qc->dev->flags & ATA_DFLAG_CDB_INTR))
+ return ata_sff_idle_irq(ap);
+ break;
+- case HSM_ST:
+- case HSM_ST_LAST:
+- break;
+- default:
++ case HSM_ST_IDLE:
+ return ata_sff_idle_irq(ap);
++ default:
++ break;
+ }
+
+ /* check main status, clearing INTRQ if needed */
--- /dev/null
+From b51aff057c9d0ef6c529dc25fd9f775faf7b6c63 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 22 Dec 2010 10:15:07 +0100
+Subject: mac80211: fix mesh forwarding
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit b51aff057c9d0ef6c529dc25fd9f775faf7b6c63 upstream.
+
+Under memory pressure, the mac80211 mesh code
+may helpfully print a message that it failed
+to clone a mesh frame and then will proceed
+to crash trying to use it anyway. Fix that.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Javier Cardona <javier@cozybit.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/rx.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1712,9 +1712,11 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
+
+ fwd_skb = skb_copy(skb, GFP_ATOMIC);
+
+- if (!fwd_skb && net_ratelimit())
++ if (!fwd_skb && net_ratelimit()) {
+ printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
+ sdata->name);
++ goto out;
++ }
+
+ fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data;
+ memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
+@@ -1752,6 +1754,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
+ }
+ }
+
++ out:
+ if (is_multicast_ether_addr(hdr->addr1) ||
+ sdata->dev->flags & IFF_PROMISC)
+ return RX_CONTINUE;
--- /dev/null
+From 42cc37fe20cc680fb58fe12ae5ba718d683b8ca2 Mon Sep 17 00:00:00 2001
+From: Baruch Siach <baruch@tkos.co.il>
+Date: Wed, 27 Oct 2010 04:03:52 -0300
+Subject: [media] mx2_camera: fix pixel clock polarity configuration
+
+From: Baruch Siach <baruch@tkos.co.il>
+
+commit 42cc37fe20cc680fb58fe12ae5ba718d683b8ca2 upstream.
+
+When SOCAM_PCLK_SAMPLE_FALLING, just leave CSICR1_REDGE unset, otherwise we get
+the inverted behaviour.
+
+Signed-off-by: Baruch Siach <baruch@tkos.co.il>
+Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/mx2_camera.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/media/video/mx2_camera.c
++++ b/drivers/media/video/mx2_camera.c
+@@ -791,8 +791,6 @@ static int mx2_camera_set_bus_param(stru
+
+ if (common_flags & SOCAM_PCLK_SAMPLE_RISING)
+ csicr1 |= CSICR1_REDGE;
+- if (common_flags & SOCAM_PCLK_SAMPLE_FALLING)
+- csicr1 |= CSICR1_INV_PCLK;
+ if (common_flags & SOCAM_VSYNC_ACTIVE_HIGH)
+ csicr1 |= CSICR1_SOF_POL;
+ if (common_flags & SOCAM_HSYNC_ACTIVE_HIGH)
--- /dev/null
+From 229bd792be0bad245b78ed8f119952733a4752e5 Mon Sep 17 00:00:00 2001
+From: David Kilroy <kilroyd@googlemail.com>
+Date: Tue, 7 Dec 2010 18:50:42 +0000
+Subject: orinoco: initialise priv->hw before assigning the interrupt
+
+From: David Kilroy <kilroyd@googlemail.com>
+
+commit 229bd792be0bad245b78ed8f119952733a4752e5 upstream.
+
+The interrupt handler takes a lock - but since commit bcad6e80f3f this
+lock goes through an indirection specified in the hermes_t structure.
+We must therefore initialise the structure before setting up the
+interrupt handler.
+
+Fix orinoco_cs and spectrum_cs
+
+<https://bugzilla.kernel.org/show_bug.cgi?id=23932>
+
+Bisected by: Matt Domsch <Matt_Domsch@dell.com>
+Signed-off by: David Kilroy <kilroyd@googlemail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/orinoco/orinoco_cs.c | 14 +++++++-------
+ drivers/net/wireless/orinoco/spectrum_cs.c | 14 +++++++-------
+ 2 files changed, 14 insertions(+), 14 deletions(-)
+
+--- a/drivers/net/wireless/orinoco/orinoco_cs.c
++++ b/drivers/net/wireless/orinoco/orinoco_cs.c
+@@ -248,20 +248,20 @@ orinoco_cs_config(struct pcmcia_device *
+ goto failed;
+ }
+
+- ret = pcmcia_request_irq(link, orinoco_interrupt);
+- if (ret)
+- goto failed;
+-
+- /* We initialize the hermes structure before completing PCMCIA
+- * configuration just in case the interrupt handler gets
+- * called. */
+ mem = ioport_map(link->resource[0]->start,
+ resource_size(link->resource[0]));
+ if (!mem)
+ goto failed;
+
++ /* We initialize the hermes structure before completing PCMCIA
++ * configuration just in case the interrupt handler gets
++ * called. */
+ hermes_struct_init(hw, mem, HERMES_16BIT_REGSPACING);
+
++ ret = pcmcia_request_irq(link, orinoco_interrupt);
++ if (ret)
++ goto failed;
++
+ /*
+ * This actually configures the PCMCIA socket -- setting up
+ * the I/O windows and the interrupt mapping, and putting the
+--- a/drivers/net/wireless/orinoco/spectrum_cs.c
++++ b/drivers/net/wireless/orinoco/spectrum_cs.c
+@@ -310,21 +310,21 @@ spectrum_cs_config(struct pcmcia_device
+ goto failed;
+ }
+
+- ret = pcmcia_request_irq(link, orinoco_interrupt);
+- if (ret)
+- goto failed;
+-
+- /* We initialize the hermes structure before completing PCMCIA
+- * configuration just in case the interrupt handler gets
+- * called. */
+ mem = ioport_map(link->resource[0]->start,
+ resource_size(link->resource[0]));
+ if (!mem)
+ goto failed;
+
++ /* We initialize the hermes structure before completing PCMCIA
++ * configuration just in case the interrupt handler gets
++ * called. */
+ hermes_struct_init(hw, mem, HERMES_16BIT_REGSPACING);
+ hw->eeprom_pda = true;
+
++ ret = pcmcia_request_irq(link, orinoco_interrupt);
++ if (ret)
++ goto failed;
++
+ /*
+ * This actually configures the PCMCIA socket -- setting up
+ * the I/O windows and the interrupt mapping, and putting the
--- /dev/null
+From e0a70217107e6f9844628120412cb27bb4cea194 Mon Sep 17 00:00:00 2001
+From: Oleg Nesterov <oleg@redhat.com>
+Date: Fri, 5 Nov 2010 16:53:42 +0100
+Subject: posix-cpu-timers: workaround to suppress the problems with mt exec
+
+From: Oleg Nesterov <oleg@redhat.com>
+
+commit e0a70217107e6f9844628120412cb27bb4cea194 upstream.
+
+posix-cpu-timers.c correctly assumes that the dying process does
+posix_cpu_timers_exit_group() and removes all !CPUCLOCK_PERTHREAD
+timers from signal->cpu_timers list.
+
+But, it also assumes that timer->it.cpu.task is always the group
+leader, and thus the dead ->task means the dead thread group.
+
+This is obviously not true after de_thread() changes the leader.
+After that almost every posix_cpu_timer_ method has problems.
+
+It is not simple to fix this bug correctly. First of all, I think
+that timer->it.cpu should use struct pid instead of task_struct.
+Also, the locking should be reworked completely. In particular,
+tasklist_lock should not be used at all. This all needs a lot of
+nontrivial and hard-to-test changes.
+
+Change __exit_signal() to do posix_cpu_timers_exit_group() when
+the old leader dies during exec. This is not the fix, just the
+temporary hack to hide the problem for 2.6.37 and stable. IOW,
+this is obviously wrong but this is what we currently have anyway:
+cpu timers do not work after mt exec.
+
+In theory this change adds another race. The exiting leader can
+detach the timers which were attached to the new leader. However,
+the window between de_thread() and release_task() is small, we
+can pretend that sys_timer_create() was called before de_thread().
+
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/exit.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -95,6 +95,14 @@ static void __exit_signal(struct task_st
+ sig->tty = NULL;
+ } else {
+ /*
++ * This can only happen if the caller is de_thread().
++ * FIXME: this is the temporary hack, we should teach
++ * posix-cpu-timers to handle this case correctly.
++ */
++ if (unlikely(has_group_leader_pid(tsk)))
++ posix_cpu_timers_exit_group(tsk);
++
++ /*
+ * If there is any task waiting for the group exit
+ * then notify it:
+ */
--- /dev/null
+From f26f9aff6aaf67e9a430d16c266f91b13a5bff64 Mon Sep 17 00:00:00 2001
+From: Mike Galbraith <efault@gmx.de>
+Date: Wed, 8 Dec 2010 11:05:42 +0100
+Subject: Sched: fix skip_clock_update optimization
+
+From: Mike Galbraith <efault@gmx.de>
+
+commit f26f9aff6aaf67e9a430d16c266f91b13a5bff64 upstream.
+
+idle_balance() drops/retakes rq->lock, leaving the previous task
+vulnerable to set_tsk_need_resched(). Clear it after we return
+from balancing instead, and in setup_thread_stack() as well, so
+no successfully descheduled or never scheduled task has it set.
+
+Need resched confused the skip_clock_update logic, which assumes
+that the next call to update_rq_clock() will come nearly immediately
+after being set. Make the optimization robust against the waking
+a sleeper before it sucessfully deschedules case by checking that
+the current task has not been dequeued before setting the flag,
+since it is that useless clock update we're trying to save, and
+clear unconditionally in schedule() proper instead of conditionally
+in put_prev_task().
+
+Signed-off-by: Mike Galbraith <efault@gmx.de>
+Reported-by: Bjoern B. Brandenburg <bbb.lst@gmail.com>
+Tested-by: Yong Zhang <yong.zhang0@gmail.com>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+LKML-Reference: <1291802742.1417.9.camel@marge.simson.net>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/fork.c | 1 +
+ kernel/sched.c | 6 +++---
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -272,6 +272,7 @@ static struct task_struct *dup_task_stru
+
+ setup_thread_stack(tsk, orig);
+ clear_user_return_notifier(tsk);
++ clear_tsk_need_resched(tsk);
+ stackend = end_of_stack(tsk);
+ *stackend = STACK_END_MAGIC; /* for overflow detection */
+
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -566,7 +566,7 @@ void check_preempt_curr(struct rq *rq, s
+ * A queue event has occurred, and we're going to schedule. In
+ * this case, we can save a useless back to back clock update.
+ */
+- if (test_tsk_need_resched(p))
++ if (rq->curr->se.on_rq && test_tsk_need_resched(rq->curr))
+ rq->skip_clock_update = 1;
+ }
+
+@@ -3821,7 +3821,6 @@ static void put_prev_task(struct rq *rq,
+ {
+ if (prev->se.on_rq)
+ update_rq_clock(rq);
+- rq->skip_clock_update = 0;
+ prev->sched_class->put_prev_task(rq, prev);
+ }
+
+@@ -3883,7 +3882,6 @@ need_resched_nonpreemptible:
+ hrtick_clear(rq);
+
+ raw_spin_lock_irq(&rq->lock);
+- clear_tsk_need_resched(prev);
+
+ switch_count = &prev->nivcsw;
+ if (prev->state && !(preempt_count() & PREEMPT_ACTIVE)) {
+@@ -3915,6 +3913,8 @@ need_resched_nonpreemptible:
+
+ put_prev_task(rq, prev);
+ next = pick_next_task(rq);
++ clear_tsk_need_resched(prev);
++ rq->skip_clock_update = 0;
+
+ if (likely(prev != next)) {
+ sched_info_switch(prev, next);
kvm-fix-osxsave-after-migration.patch
mv_xor-fix-race-in-tasklet-function.patch
ima-fix-add-lsm-rule-bug.patch
+libata-sff-fix-hsm_st_err-handling-in-__ata_sff_port_intr.patch
+mac80211-fix-mesh-forwarding.patch
+alsa-hda-use-lpib-quirk-for-dell-inspiron-m101z-1120.patch
+sched-fix-skip_clock_update-optimization.patch
+block-deprecate-queue_flag_cluster-and-use-queue_limits-instead.patch
+x86-microcode-fix-double-vfree-and-remove-redundant-pointer-checks-before-vfree.patch
+posix-cpu-timers-workaround-to-suppress-the-problems-with-mt-exec.patch
+mx2_camera-fix-pixel-clock-polarity-configuration.patch
+orinoco-initialise-priv-hw-before-assigning-the-interrupt.patch
--- /dev/null
+From 5cdd2de0a76d0ac47f107c8a7b32d75d25768dc1 Mon Sep 17 00:00:00 2001
+From: Jesper Juhl <jj@chaosbits.net>
+Date: Sat, 25 Dec 2010 19:57:41 +0100
+Subject: x86/microcode: Fix double vfree() and remove redundant pointer checks before vfree()
+
+From: Jesper Juhl <jj@chaosbits.net>
+
+commit 5cdd2de0a76d0ac47f107c8a7b32d75d25768dc1 upstream.
+
+In arch/x86/kernel/microcode_intel.c::generic_load_microcode()
+we have this:
+
+ while (leftover) {
+ ...
+ if (get_ucode_data(mc, ucode_ptr, mc_size) ||
+ microcode_sanity_check(mc) < 0) {
+ vfree(mc);
+ break;
+ }
+ ...
+ }
+
+ if (mc)
+ vfree(mc);
+
+This will cause a double free of 'mc'. This patch fixes that by
+just removing the vfree() call in the loop since 'mc' will be
+freed nicely just after we break out of the loop.
+
+There's also a second change in the patch. I noticed a lot of
+checks for pointers being NULL before passing them to vfree().
+That's completely redundant since vfree() deals gracefully with
+being passed a NULL pointer. Removing the redundant checks
+yields a nice size decrease for the object file.
+
+Size before the patch:
+ text data bss dec hex filename
+ 4578 240 1032 5850 16da arch/x86/kernel/microcode_intel.o
+Size after the patch:
+ text data bss dec hex filename
+ 4489 240 984 5713 1651 arch/x86/kernel/microcode_intel.o
+
+Signed-off-by: Jesper Juhl <jj@chaosbits.net>
+Acked-by: Tigran Aivazian <tigran@aivazian.fsnet.co.uk>
+Cc: Shaohua Li <shaohua.li@intel.com>
+LKML-Reference: <alpine.LNX.2.00.1012251946100.10759@swampdragon.chaosbits.net>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/microcode_intel.c | 16 +++++-----------
+ 1 file changed, 5 insertions(+), 11 deletions(-)
+
+--- a/arch/x86/kernel/microcode_intel.c
++++ b/arch/x86/kernel/microcode_intel.c
+@@ -364,8 +364,7 @@ static enum ucode_state generic_load_mic
+
+ /* For performance reasons, reuse mc area when possible */
+ if (!mc || mc_size > curr_mc_size) {
+- if (mc)
+- vfree(mc);
++ vfree(mc);
+ mc = vmalloc(mc_size);
+ if (!mc)
+ break;
+@@ -374,13 +373,11 @@ static enum ucode_state generic_load_mic
+
+ if (get_ucode_data(mc, ucode_ptr, mc_size) ||
+ microcode_sanity_check(mc) < 0) {
+- vfree(mc);
+ break;
+ }
+
+ if (get_matching_microcode(&uci->cpu_sig, mc, new_rev)) {
+- if (new_mc)
+- vfree(new_mc);
++ vfree(new_mc);
+ new_rev = mc_header.rev;
+ new_mc = mc;
+ mc = NULL; /* trigger new vmalloc */
+@@ -390,12 +387,10 @@ static enum ucode_state generic_load_mic
+ leftover -= mc_size;
+ }
+
+- if (mc)
+- vfree(mc);
++ vfree(mc);
+
+ if (leftover) {
+- if (new_mc)
+- vfree(new_mc);
++ vfree(new_mc);
+ state = UCODE_ERROR;
+ goto out;
+ }
+@@ -405,8 +400,7 @@ static enum ucode_state generic_load_mic
+ goto out;
+ }
+
+- if (uci->mc)
+- vfree(uci->mc);
++ vfree(uci->mc);
+ uci->mc = (struct microcode_intel *)new_mc;
+
+ pr_debug("CPU%d found a matching microcode update with version 0x%x (current=0x%x)\n",
projects / thirdparty / kernel / stable-queue.git / commitdiff
